Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    325s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 18:15

General

  • Target

    https://ucad00f430b886f04715078d9fa0.dl.dropboxusercontent.com/cd/0/get/CHA0a5lAw_upIU6nuECVuaBOx56zrN8zr56z7lcyYbbQy-5HiHXV0cprImx7j2V83gR3M10BwcwYxoKYppWZsWl1nZxOUVlVQyMhr1uXZyAKCoe_eiQy0DEeIZUwB61lOh_4Mmc0D9RNWIo9jiH4dJxB/file?dl=1#

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ucad00f430b886f04715078d9fa0.dl.dropboxusercontent.com/cd/0/get/CHA0a5lAw_upIU6nuECVuaBOx56zrN8zr56z7lcyYbbQy-5HiHXV0cprImx7j2V83gR3M10BwcwYxoKYppWZsWl1nZxOUVlVQyMhr1uXZyAKCoe_eiQy0DEeIZUwB61lOh_4Mmc0D9RNWIo9jiH4dJxB/file?dl=1#"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ucad00f430b886f04715078d9fa0.dl.dropboxusercontent.com/cd/0/get/CHA0a5lAw_upIU6nuECVuaBOx56zrN8zr56z7lcyYbbQy-5HiHXV0cprImx7j2V83gR3M10BwcwYxoKYppWZsWl1nZxOUVlVQyMhr1uXZyAKCoe_eiQy0DEeIZUwB61lOh_4Mmc0D9RNWIo9jiH4dJxB/file?dl=1#
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3200
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.0.153724024\979126277" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {317eda23-4cb2-4411-a489-f02f8b0ce5d5} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 1920 18bebdfae58 gpu
        3⤵
          PID:1244
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.1.977951067\13116749" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1335a27-e0d0-4d74-a692-8dffd3285ae3} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 2400 18bdf0e9058 socket
          3⤵
            PID:3268
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.2.823031383\607618056" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 3112 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce8f97d4-46b5-4c38-845b-b917ffca9913} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 2844 18befacf758 tab
            3⤵
              PID:3860
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.3.96318112\192982586" -childID 2 -isForBrowser -prefsHandle 1104 -prefMapHandle 1624 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b069235-1615-44e5-831c-d2441df111ab} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 4016 18bdf06c858 tab
              3⤵
                PID:3484
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.4.2103816113\1308551489" -childID 3 -isForBrowser -prefsHandle 4740 -prefMapHandle 4736 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e5f21c2-1d6d-4e3e-8094-07fa6c6a571c} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 4468 18bf00c2958 tab
                3⤵
                  PID:5024
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.5.1435735122\265064730" -childID 4 -isForBrowser -prefsHandle 4444 -prefMapHandle 4692 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b42e273-77d0-417b-a5d9-9298957d7a9d} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 4756 18bf0978658 tab
                  3⤵
                    PID:3832
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3200.6.966830183\1788403283" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e560cbce-3447-4ff2-9a1c-d8dbe34c77dc} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" 4980 18bed097e58 tab
                    3⤵
                      PID:3128

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\04pqhkp3.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  22KB

                  MD5

                  6229c030e1f83b25134fc3f3afaca700

                  SHA1

                  315ac3b0606bcbc405c88e5468ea24233f2b7513

                  SHA256

                  966ef57372d5405a2b64a2d99950448b9fe41d4355a5491102b0a848267a0bb3

                  SHA512

                  2dc7051659f9ec0cae0ae0e85ca3290f8649d8b143672820d51cbf3d507af89165236bd38cc8d7ba06f0fa3ca3d096dc2fa708750cfd5bb9821a22ae30c8558f

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\04pqhkp3.default-release\cache2\entries\1FBE989CF3300E908319D8911334CCD19C57BCAD

                  Filesize

                  6.5MB

                  MD5

                  3bcb3693c0363eb8e4cdb83e6118d3fa

                  SHA1

                  46da777a90cf92df8a544a366e6535eb297f7178

                  SHA256

                  4b17bebe1d5a29b20a995cc04d5ab9278bed1a305633ef279a0a44855361a5b1

                  SHA512

                  d24b696b9bc8d83555e33aa065a18f300d1f478320282ab804ddf96fc380ab4d30e7ad0717be3d3cd52f63f24598022592b17cb0ab6912fd3c5f4df68416b9bc

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  403c8a149a5404c9efe23f93244d064d

                  SHA1

                  6c8716d5dfbfc4a6580c8210259f53a572b06a9d

                  SHA256

                  e0a1369dee1f0674ddd2d6f8226643542370a931068200bdc9392ff30dd674f2

                  SHA512

                  65bbfd5e5bca0d7460c620b769ca49d7c5a3266fcc30f0a930120e5cf38be247c2902c8fedf438924d440103327ec213e0b0381221a4b5e57ae5a5ac09684063

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-widevinecdm\4.10.2449.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-widevinecdm\4.10.2449.0\manifest.json

                  Filesize

                  372B

                  MD5

                  6981f969f95b2a983547050ab1cb2a20

                  SHA1

                  e81c6606465b5aefcbef6637e205e9af51312ef5

                  SHA256

                  13b46a6499f31975c9cc339274600481314f22d0af364b63eeddd2686f9ab665

                  SHA512

                  9415de9ad5c8a25cee82f8fa1df2e0c3a05def89b45c4564dc4462e561f54fdcaff7aa0f286426e63da02553e9b46179a0f85c7db03d15de6d497288386b26ac

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll

                  Filesize

                  10.2MB

                  MD5

                  54dc5ae0659fabc263d83487ae1c03e4

                  SHA1

                  c572526830da6a5a6478f54bc6edb178a4d641f4

                  SHA256

                  43cad5d5074932ad10151184bdee4a493bda0953fe8a0cbe6948dff91e3ad67e

                  SHA512

                  8e8f7b9c7c2ee54749dbc389b0e24722cec0eba7207b7a7d5a1efe99ee8261c4cf708cdbdcca4d72f9a4ada0a1c50c1a46fca2acd189a20a9968ccfdb1cf42d9

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  dea1586a0ebca332d265dc5eda3c1c19

                  SHA1

                  29e8a8962a3e934fd6a804f9f386173f1b2f9be4

                  SHA256

                  98fbbc41d2143f8131e9b18fe7521f90d306b9ba95546a513c3293916b1fce60

                  SHA512

                  0e1e5e9af0790d38a29e9f1fbda7107c52f162c1503822d8860199c90dc8430b093d09aef74ac45519fb20aedb32c70c077d74a54646730b98e026073cedd0d6

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  d11bf53d4e97ef212a3c0b5cd7bb7df3

                  SHA1

                  1d9a45a500b644dc8033335857de2d81c739e35b

                  SHA256

                  a71966ebd462d73fc1b23cd9a646ffbbd2f0dcc1e831ee067cb9567036caa52f

                  SHA512

                  e44d9be1a29cfe56fb3c229e7942cc870fd21dd60a4dec86e43b80211e59f5b4dba207245062c9c3205f73ba39369c949e1a93b81fd93904124df407e7f68bce

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  ab6c5465b36477c0c3859049762d2523

                  SHA1

                  9ee13004b6c4d07bba61bd64aa663614017d6121

                  SHA256

                  2aa4a10812a702053d5d87e88ef40fce3fc68b37cf9bd580f384c2bbf28a3146

                  SHA512

                  748a7bc5c556b305e1cade4dbfa4e1208df4fb8c418e14ec8d4d75cec50ffe3b588698d580b547f76a2f529641b90c3b6a9fa3842b215e13fa0642d2e31aab94

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\prefs-1.js

                  Filesize

                  8KB

                  MD5

                  56bf789660dd5b11f7f23465642508cd

                  SHA1

                  6c1ccfde040bf1c1363e288f63d1b6686a1e698f

                  SHA256

                  904d7fc25dc013da91bf81d3a71cbfe129a6028312515be425f3d0cb55bc05a1

                  SHA512

                  8ea345f2406ac62e0c2acaa281d8fa04e58745550257f2278dd60fe1ecd8ce37150eca1db668c09589373b273e75ec05c3acf1b3482c4618554bb3d78f00d8c8

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  55e994f38e10a825e24cb8469d27ba43

                  SHA1

                  b6cf705bff56566b39786928c283cf51f3cc2ca0

                  SHA256

                  392029089ffd96e1eee6b9b4d0a7a194ad95427007ce681d0d89052a50c65aed

                  SHA512

                  e2d99ae0f46c4bf7d421b3a00a980f02484c71c1145feb9e1f094dd7bca295aebb9580b7095ddf4277b87315e4c81fc8026613b2a2db3611da20b438c9a4a543

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  1KB

                  MD5

                  19927dabbbfbac3cbe4b470ca6583ae2

                  SHA1

                  20b21e4b212a2ceb2f3532cc240edba9c06a000e

                  SHA256

                  6ba709886f5a918386963a01f0f1dc6497c006ebc76fe9647592926573842f95

                  SHA512

                  01ecc17754e25a977025a9fd52c953ffb60d612036a416dc2cb7c0c4434bedb97bb2f557a9496c1f0c55d599f97e09c7241a3a80deb4aa98418aeacc4422423b

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  3KB

                  MD5

                  11443e49aebeb2ec7c2187ddafe7d935

                  SHA1

                  5a0b8a8bc0af5cceffdefe2e361a568b6b603839

                  SHA256

                  f3e92a8f9a181c40f08cc0a9690816fbe12f146168d036f23c345adb7515a623

                  SHA512

                  8cbaabfaad014b2913586cae56afeb88dd77011149677095005146a643b6729707dc67019cf4effc4f78d2405a131b4c3006f38c3d0f89b7cbee1c365168547a

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04pqhkp3.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  3KB

                  MD5

                  cf51bff68e2fc6e5ebbc04c2b24bdad4

                  SHA1

                  2b8530c7187a942c700bdb76202c3ffd1e4fe374

                  SHA256

                  a97468a439c52180484b5cc380e1a5d9d98222db6695eb2214101d404d6dc1d7

                  SHA512

                  01adad3078096a79cd72ade527439ee4f0b616f9f109c3df2661a89084ced4143d60cf49fa37ca7c84a961f8ebc8ab6cfe06227b94b2e0dbe9c5c5ea99e46b30